Prevent buffer overflow when custom completions edit the commandline

This was introduced in a7ea7648c3
"Completion: maintain cursor position when there is no completion"

src/reader.cpp

@@ -2561,6 +2561,11 @@ void reader_data_t::handle_readline_command(readline_cmd_t c, readline_loop_stat
                                                              completion_request_t::fuzzy_match};
                 complete_func(buffcpy, &rls.comp, complete_flags, vars, parser_ref);
 
+
+                // User-supplied completions may have changed the commandline - prevent buffer overflow.
+                if (token_begin > buff + el->text.size()) token_begin = buff + el->text.size();
+                if (token_end   > buff + el->text.size()) token_end   = buff + el->text.size();
+
                 // Munge our completions.
                 completions_sort_and_prioritize(&rls.comp);
 

tests/complete.expect

@@ -0,0 +1,20 @@
+# vim: set filetype=expect:
+spawn $fish
+set sid $spawn_id
+expect_prompt
+
+send_line {
+    complete -c my_is -n 'test (count (commandline -opc)) = 1' -xa arg
+    complete -c my_is -n '__fish_seen_subcommand_from not' -xa '(
+	set -l cmd (commandline -opc) (commandline -ct)
+	set cmd (string join " " my_is $cmd[3..-1])" "
+	commandline --replace --current-process $cmd
+	complete -C"$cmd"
+    )'
+}
+send "my_is not \t"
+send "still.alive"
+expect -re {.*still.alive} {
+} eof {
+    error "did fish crash?"
+}